314 questions
Where can I find the applicable scopeIds for List RoleDefinitions in the Azure DevOps REST API?
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(12.8, 82%, 11%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EJ0%3C/text%3E%3C/svg%3E)
JamesWatson-0269
25
Reputation points
The API documentation for List RoleDefinitions states that the URI for the call is as follows:
https://dev.azure.com/{organization}/_apis/securityroles/scopes/{scopeId}/roledefinitions?api-version={version}
The documentation states that scopeId is required but gives no other information about it. Literally: the description is blank. Is there some other API call or resource for getting the list of scopes that can be used with this?
I've tried using project UUIDs, namespace Ids, Ids for built-in roles. All respond with an error: "SecurityRoleScope {scope-id-I-used} does not exist"
This API appears to be useless without know what kind of scopeId is relevant and what those Ids are. Where can I find this?
Azure DevOps
{count} votes
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(259.20000000000005, 40%, 35%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EBH%3C/text%3E%3C/svg%3E)
Bodapati Harish 400 Reputation points Microsoft External Staff Moderator2025-04-18T10:41:56.88+00:00 Hello JamesWatson-0269,
For the List RoleDefinitions API, the
scopeIdis used to tell Azure DevOps which part of the system you're trying to list roles for such as the entire organization or a specific project.- Organization-level (collection scope):
52d39943-cb85-4d7f-8fa8-c6baac873819 - Project-level: Use your project's GUID. You can retrieve it using the following API:
GET https://dev.azure.com/{organization}/_apis/projects/{projectName}?api-version=7.1-preview.1
Example request:
GET https://dev.azure.com/{organization}/_apis/securityroles/scopes/52d39943-cb85-4d7f-8fa8-c6baac873819/roledefinitions?api-version=7.1-preview.1If you receive an error like
"SecurityRoleScope {scope-id} does not exist", it typically means that the providedscopeIdis either incorrect or not supported for that API.Currently, Microsoft does not offer an API to list all valid
scopeIdvalues, but several known scopes have been identified by the community. You can often find examples in the official Azure DevOps REST API documentation and from inspecting actual API calls within Azure DevOps using browser developer tools.I hope this helps. Let me know if you need any further clarification, and I’ll be happy to assist you.
- Organization-level (collection scope):
-
JamesWatson-0269 25 Reputation points
2025-04-18T16:26:41.84+00:00 "Currently, Microsoft does not offer an API to list all valid
scopeIdvalues," This is ridiculous but thanks for the answer. -
JamesWatson-0269 25 Reputation points
2025-04-18T16:40:11.78+00:00 BTW: the project level scope id does not work for this call.
-
Bodapati Harish 400 Reputation points Microsoft External Staff Moderator
2025-04-21T05:00:33.59+00:00 Hello JamesWatson-0269,
Thanks for your update. Let me help clarify how
scopeIdworks with the List RoleDefinitions API.The
scopeIdparameter is required to tell Azure DevOps which part of the system you're querying. In most practical use cases, this API is only functional with organization-level scope IDs.Organization-Level scopeId: To retrieve organization-wide role definitions, use this fixed scope ID:
52d39943-cb85-4d7f-8fa8-c6baac873819Example:
GET https://dev.azure.com/{organization}/_apis/securityroles/scopes/52d39943-cb85-4d7f-8fa8-c6baac873819/roledefinitions?api-version=7.1-preview.1Project-Level scopeId: Although it may seem that project GUIDs can be used as scopeIds here, they do not work with the
List RoleDefinitionsAPI. If you attempt this, you'll typically get an error like:"SecurityRoleScope {scope-id} does not exist"For project-specific roles, it's recommended to use the Role Assignments API instead.
Example:
GET https://dev.azure.com/{organization}/_apis/securityroles/scopes/52d39943-cb85-4d7f-8fa8-c6baac873819/roleassignments/resources/{projectGUID}?api-version=7.1-preview.1How to discover valid scopeIds: Currently, Microsoft does not provide an API to list all valid
scopeIdvalues. However, you can find known working ones by inspecting API calls within the Azure DevOps portal:Open Developer Tools (F12) in your browser.
Go to Organization Settings > Security or any permission-related section.
Monitor network requests to
_apis/securityroles/scopes/{scopeId}— the values used there are valid scopeIds.Important clarification: Some identifiers like
project-git,project-build,distributedtask.environmentreferencerole, etc., are actually security namespace IDs, not scopeIds. These are used in different APIs (e.g., permission management) but will not work with theList RoleDefinitionsendpoint.Hope this clears up the confusion. Let me know if you'd like help with specific role or permission use cases.
-
Bodapati Harish 400 Reputation points Microsoft External Staff Moderator
2025-04-23T06:20:02.17+00:00 Hello JamesWatson-0269,
Following up to see if you have chance to check the previous response and help us with requested information to check and assist you further on this.
-
Bodapati Harish 400 Reputation points Microsoft External Staff Moderator
2025-04-24T07:09:00.1533333+00:00 Hello JamesWatson-0269,
We haven’t heard from you on the last response and was just checking back to see could you please provide more details on your requirement so that I can assist you further.
Sign in to comment
Sign in to answer